26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 36eeed998c47… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 36eeed998c47…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe"],"about":{"@type":"SoftwareApplication","name":"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tabe,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00e9020000107e380000000000080000000000000070f6300000000000000000000000000025483ff0fe0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000001afffe07000070f6300000000000000000000000000098f6300000000000000000000000000049222bcec497000000000000000000000882b9fffe0700000000000000000000e005010000000000000000000000000000000000000000000000000000000000b4bec0fffe0700004059c1ff (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000c803a977000000000000000000000000a0000000000000000000380000000000000000000000000094000000000000001803380000000000d8dd9c7700000000000038000000000002000000000000009400000000000000a0000000000000001803380000000000e0ef1f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b8141f0fe07000018000000 (UID: 00000000-00003056)28:T6be,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000100000000000000bbbac0fffe070000f0b03f00000000001014b9fffe07000001000000000000001aab93fdfe070000010000000000000059bcc0fffe0700000000000000000000000000000000000000000000000000009ad1bafffe07000008000000 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000061006400620064003300360033006100320036003900650037003700380064006300310063003000620064003200310063003100390032003100380030006400650032003200300061006600310033003000640035003900640037003400660065002e00650078006500000000000000 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000001000000000000008820bffbfe070000f8ce1f00000000001099b9000000000004669a7700000000020000000000000048ce1f000000000008cf1f0000000000f8ce1f000000000048ce1f000000000024b393fdfe07000002100000fe070000000000000000000000000100 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003056)29:T249c,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter C:\msvcrt.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003056)2a:Te032,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetClassLongPtr (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter SetClassLongPtrW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003056) "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003056)2b:T75d,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" failed to load missing module "C:\msvcrt.dll" - [base:0; Status:c0000135]2c:T20ea,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "GDI32.DLL" at base 7feff1a0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fefda30000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9d70000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "KERNEL32" at base 77860000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "ADVAPI32.DLL" at base 7feff0c0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fef1c50000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "SHLWAPI.DLL" at base 7fefda60000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "VERSION.DLL" at base 7fefc750000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fee9550000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "USER32.DLL" at base 930000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "MSCOREE.DLL" at base 7fef1d00000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "NTDLL" at base 77980000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "PSAPI.DLL" at base 77b40000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "RPCRT4.DLL" at base 7feff210000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "KERNEL32.DLL" at base 77860000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fee7f50000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "OLE32.DLL" at base 7fefdae0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "CRYPTBASE.DLL" at base 7fefd4d0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefbc20000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fef1c10000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7feefa50000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fee72e0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7feedf90000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fee6230000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fee57b0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fee5670000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fee4dc0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NLSSORTING.DLL" at base 7fef1bf0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "NTDLL.DLL" at base 77980000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "SHELL32.DLL" at base 7fefdde0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fefec90000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "PROFAPI.DLL" at base 7fefd670000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "BCRYPT.DLL" at base 7fefcfb0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "CRYPTSP.DLL" at base 7fefce60000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fefcb60000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "IMM32.DLL" at base 7fefda30000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "COMCTL32.DLL" at base 7fef9e00000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "GDIPLUS.DLL" at base 7fefba00000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_145EB2808B8D6928\GDIPLUS.DLL" at base 7fefba00000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77860000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "DWMAPI.DLL" at base 7fefb3c0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7fefdae0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "CLBCATQ.DLL" at base 7fefdd40000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7feff340000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "OLEAUT32.DLL" at base 7fefecb0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "AMSI.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "C:\MSVCRT.DLL" at base 0 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "MSVCRT.DLL" at base 7feff7c0000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefec90000 "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" loaded module "RPCRTREMOTE.DLL" at base 7fefd5c00002d:T4c7,"10001100c4970000e647d5f1fe070000@ADVAPI32.dll" "0d000e00c49700000a48d5f1fe070000@ADVAPI32.dll" "0d000e00c4970000fa47d5f1fe070000@ADVAPI32.dll" "0b000c00c4970000d847d5f1fe070000@ADVAPI32.dll" "10001100c4970000c447d5f1fe070000@ADVAPI32.dll" "15001600fe070000a88a43f0fe070000@ADVAPI32.dll" "0e000f00fe070000608b43f0fe070000@ADVAPI32.dll" "0e000f00fe070000c08b43f0fe070000@ADVAPI32.dll" "11001200fe070000789443f0fe070000@ADVAPI32.dll" "11001200fe070000109543f0fe070000@ADVAPI32.dll" "12001300fe070000589543f0fe070000@ADVAPI32.dll" "12001300fe070000b89543f0fe070000@ADVAPI32.dll" "14001500fe07000090c843f0fe070000@ADVAPI32.dll" "14001500fe070000d8c843f0fe070000@ADVAPI32.dll" "14001500fe070000c0c843f0fe070000@ADVAPI32.dll" "17001800fe07000000c943f0fe070000@ADVAPI32.dll" "0d000e00fe070000f0c843f0fe070000@ADVAPI32.dll" "11001200fe07000030c943f0fe070000@ADVAPI32.dll" "11001200fe07000018c943f0fe070000@ADVAPI32.dll" "0f001000fe070000a8ca43f0fe070000@ADVAPI32.dll" "14001500fe070000b8ca43f0fe070000@ADVAPI32.dll" "14001500fe07000000cb43f0fe070000@ADVAPI32.dll" "0c000d00fe07000018cb43f0fe070000@ADVAPI32.dll" "0c000d00fe07000050cb43f0fe070000@ADVAPI32.dll" "0e000f00fe07000040cb43f0fe070000@ADVAPI32.dll"2e:T4c1,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2f:Tc42,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003056-00000C65-48371551] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003056-00000C2A-49443339] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003056-00000C2A-49754361] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003056-00000C2A-51192668] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003056-00000C2A-51383529] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003056-00000C2A-51712886] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003056-00000C2A-51761860] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003056-00000C2A-51971891] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00003056-00000C2A-52461293] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003056-00000C2A-52599561] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00003056-00000C2A-52662941] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00003056-00000C2A-52749025] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003056-00000C2A-52969807] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00003056-00000C2A-53017739] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00003056-00000C2A-53191093] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll" [Source: 00000000-00003056-00000C2A-53428094] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003056-00000C2A-53719146] Observed system executable string:"%WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll" [Source: 00000000-00003056-00000C2A-54409515] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003056-00000C2A-55160646] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003056-00000C2A-55308956]30:Tb74,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "")31:Tfe6,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "36EEED998C47E1EADBD363A269E778DC1C0BD21C192180DE220AF130D59D74FE"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "")32:T629,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"33:T801,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\FLTLIB.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\Temp\VxOle64.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to touch file "C:\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe.config"34:T7a2,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\FLTLIB.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"35:T8c1,"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe.config" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\PaintDotNet\" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.INI" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe.Local\" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36EEED998C47E1EADBD363A269E778DC1C0BD21C192180DE220AF130D59D74FE.EXE.CONFIG" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\PAINTDOTNET" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36EEED998C47E1EADBD363A269E778DC1C0BD21C192180DE220AF130D59D74FE.INI" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe" trying to access non-existent file "C:\36EEED998C47E1EADBD363A269E778DC1C0BD21C192180DE220AF130D59D74FE.EXE.LOCAL"36:T178f,Observed email domain:"in_l_xs.k.t.t.w.ef_g m.h.ro|.w_w u.c b j.9- f.t.2.p- y.n.b_kf_ejh.b.6.r_r_k.n q.r_r#_nw?;( xl d.a w.zf.u.a_t mx.mh_k~ a.aw g_i b_g[.w.j.2f_a" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"( b u.cd&n.qhy.n.37_xxw.a.0_o w.v_awii.ug&.h.mx.s&.3" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"c k-$\_mx.z.vyb a.2_d( e=.h.1 al.hc.e>`_a+_c_g_w l_lrda) cf x_yp&.m t_n3_d.4+#h.zt2" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"_u jv.r.n_j_r k_i.w.f.o# h rmx.ot+.4z_w.0%.h.5_nh_d_m@_v.zd.al_n_t_n_j g t[.3_d`_m" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"i.9.b.p.q3.6w4%.v_i v e.g=_l,r.a_y.w_x>_y a_y m.b.7.2.9.s_v.s.a n.x@m7.o_t~_z_c_o_g_a x xew4n_m_l%lm#y46 m p ful_r p z.l u.mx.q e_n=_ew<_j k.b.k.5.a_es e.c.vux_ol p_l_aze_m.o_a b_x y)kz.ml_m t.cd.zoq c.kcx.s_d.z_yx[_k" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:".w za.b.0.t.d m.m*[_p_mqdc8_x s.b.r k_b.c.t.j ts_t- hn_nl a u[jocl a.a.f.su x.p_b.0_d a r_o_c%p.o.d>p uh_f.c_x g_y.d.9_dqu w.g_b mx.b.h w r t,_q.p up.rp_vj p n.f ur p.2 emi.b.0.d.akb f.5 f_y.d! lqr_d t.w.o.nx_q_w" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:".3_k.6@/ e,f.y_ho$.w.5_s.z iu+h{.n fa y i r i.s_u7.3 l_u fn.8^xz_b.j t.mx.07 a ts.u+_p.w-_s_s.k_z_uc2 w) r&/>.m.l=.j.z_c.8 w" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"l.c_o.l$ k.ge_o:.i gw^v n m1_txsk_e_d t x.f y q_w r.u.vh.ro.g n^_n/$:) t-.j4u n>-.e_i_s1_wjp_o x ogd.4d_w.k_n.1 n_l i_x.n_h5.w} l.u.0 b.c m s_o_fmx.n o.r_w p.d.h_p.7.a_axa.i}6`}_g_r_x f_bt_vg d k.be_rb j k_m.w.r_j qi" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"=.a.5! w_k.kl_y,@_r.z v.v r f/_w_e4t p# n.fc_l.6.w_t?1 q~.0_j)@ n_i_r_j.wg_b.e_d_e_u_x vac.k_t.j j.2q ehpd.a w l h_mr_oyx r_m.e.k_n_d.k.b_i.w.3.s.px_yvn fm u}t.mx.db1_w_w a{g.v4_x;_n1.o n h.e.v.im p_b tez" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"z.n h n.xm)_t.k_g.p b v%.c w.p~ g~_o m k_zq_p.cd m.u.h pg mx.dq oj94gtj k q7.x.f.0 b.i s_o mnc.8.ew_u.2_i y_xk.fv.j s_g.q*.d.r.o_r m i.t.2 k.r+.9p3.v ju f p}/@le.o]l_v y|.9=a.m&.w o-_r.o v.vg" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"_c_lgl| rd.r zs_w.ge` a f|q.al.lf e t.a: syd.j5 fp.g1_h_u=_m.2.h:.z.5*.k.mx.k_n7 x.c_u.f.7 s_t_i+ k.i_h&.c_c r.7.a pq.n6.yo.o_c~.r o_x58.k g:.t z.pr_f.6.s_t.n.j_fw.b_q w~_bv@/.3" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"gc.ze q.q mx.m r9)_rd: o u s.v s_k.l.2a%_m xim.x_i_g_i x.d9;iy.ja3) ilm.yv.0( oq;_qb.q jl_p}f z x r_ir)%_n fd.n3h! q_c oi e_k d.7.sw]$ e.y u_u.i.ev.c_p@_n_d.hv nc:_w f@_a.u.3 j f.f x<7(=y.wzi s[c.k(/_a(" [Source: 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe] Observed email domain:"_s_p[k.k_r.q_r l c_j t p_u2 k.f_cajjy|_w_p.g?.n k_n.k_h.8m_g_i.f.hr,u i?.m# i.x:.k_u.r o zwn ug_x_w.mx.a.k.by z.k.z8.x t_se.2 s z g g.k0_t.ef_j ph_d b.vn_q_mi_a d_p u.m_h r.8.b.xo{u^.g_n.l t b.i r.5#.a$k_z&.500_y_c.a.l!.wd_i x.g.r\r\nk.ieo k_b_n y_m" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"in_l_xs.k.t.t.w.ef_g m.h.ro|.w_w u.c b j.9- f.t.2.p- y.n.b_kf_ejh.b.6.r_r_k.n q.r_r#_nw?;( xl d.a w.zf.u.a_t mx.mh_k~ a.aw g\r\n_i b_g[.w.j.2f_a" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"( b u.cd&n.qhy.n.37_xxw.a.0_o w\r\n.v_awii.ug&.h.mx.s&.3" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"\r\n c k-$\\_mx.z.v\r\nyb a.2_d( e=.h.1 al.hc.e>`_a+_c_g_w l_lrda) cf x_yp&.m t_n3_d.4+#h.zt2" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"a_u_o\\wghc.z f|.ds.jl_a)a.u c_v.a.0_f_i_l.6)_cc7.4d.h.y.q.q_b}_c.afn_o_s_c_w_i e_ul.a q ou q.x.0 n_ub e_t> m_a.j.y.mx.l.n w r_m.up m5.d b n w fb?.k).1j m.g k" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"q_u_g.z=.a.y c w x o_r_fv v_mx.j.w_u.7`e k.3 n_f_i< h_wi_y\r\n e_i.h r j_timh.5_c7.2u2 b_m9_v_m.n_ay^_p.e_ll.u| x ir.v_n_n f w" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"o.k.2u) p lwg hp_o.xcq(z i(.y_dg`.6 mx.afyld%j b.d2.f.c~m wd.3 x.x, q o< n.h_p_y_h.m_t c.9/ n i h.s.r@_w_a f v_t_in_e.o_r_y%.g a]b.5.ca|7? d" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"i.9.b.p.q3.6w4%.v_i v e.g=_l,r.a_y.w_x>_y a_y m.b.7.2.9.s_v.s.a n.x@m7.o_t~\r\n_z_c_o_g_a x xew4n_m_l%lm#y46 m p ful_r p z.l u.mx.q e_n=_ew<_j k.b.k.5.a_es e.c.vux_ol p_l_aze_m.o_a b_x y)kz.ml_m t.cd.zoq c.kcx.s_d.z_yx[_k" [Source: 6000015-CodeGen~GetBytes] Observed email domain:".s_d.9}_mx.z_f_ob.p@.q e u_e.b@1z t5<_j.x dc l_f<_t#`!_t w.qv.l_g p_n b.5.a_n oi.kh clkgs_h.e_h.5 d.o b8.z_p.b&f# j_ak_l.mrx_sx.k.0b+2 j) x a.3.9mu_r_l.v a_d6.jl_u+_n\r\nh_g u= e q w,!_y_sy2 i_i_ih#.p).a0n@.1_r.g_y|" [Source: 6000015-CodeGen~GetBytes] Observed email domain:".g.5.b.c.8!92.g[< c_x_jf.u.n.v.1.e_p o.mx.b_h_w_b_hs\\ d_a.z: p6yx_b_hy_o3_e a?_q.ph ls e.9,.j_le_f_k p izb k_r lc cs_gm6gq p_r^ g" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"_i_js.jql e t} i|_u_rpx*mx.x.v.m_e m.qm_x_pc_n e_hw.z.a_x.hv.h_z.8.7;j.t pm.d k_s ql_ox|y_ut w hl_s_y_j_j_s.i~.f.d_i:z.n.z_t4 d? v.m!_l3d n|.k y|.7.z3j.j g_c.in z0" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"i4 r.3 s_a.ji_o(.k.a_uo.rio_ta_y_h\r\n< e_pzi.c_t.cy z- r|p_a.db_m_a d.a_a_z_l.7_i_k hbwk_b9_n.t>.zl_i_r_y.0e_dz_mv_t_x q q_u k9fc_y-.68_l bba.j.i ue rtv_b f c d m mx.h_kc_w" [Source: 6000015-CodeGen~GetBytes] Observed email domain:"_f q.s.qjo_mrzj_c.w v.qt_z_h1+.s:_y.w.olwg_wn wl-0_z_c[ n n v s l4.iq_omx.c.r c oau.e}.5_xc u_x.y_go.o\\).d.d wqv.pe@ j.p_gq].a s.i.u.9 z_h h.rv_v_r w t.pj.w q%_v6.to.q j!_mf_v.2.gvkr_fd_o.j.t.xm0.r!8.g_q*_k&_c f" [Source: 6000015-CodeGen~GetBytes]37:T604e,Heuristic match: "paint.net" Heuristic match: "_o t_c.j_x.s_i zko.mmt b.l t_h.b7_tj d_g gg e m iq_y.e_e.u_d.h_s_f.xub.2_d_a!_w.t.0 h)w.9.uso% q s~.y.bg" Pattern match: "b.rh/_w.x.j|" Heuristic match: "~s k pl~b b_sqc_c ec8.f s_l_v_b.2 d<.xt.6_x.kb m_rq.vdob x}04_i d.k_q_hi_l_l v k_f7vi@i_c;]_r.n3.g.z s z_y y_t.7.j-.np.zjvo c.z.h.hbf_c<.bn.o9xj<9.k_xz{_i_s.py h}w w_i`kh-k mz.aq_m.u_a2.e0_w.z_i_a.s.ls" Heuristic match: "q_d g6 l.c_tk a_p b.g; d.6:&]h jj.c.j y;.w~.r2$0{.m.lu" Pattern match: "ye.rd/_u{_xq.l" Pattern match: "o.ow/r_c:*" Heuristic match: "z_j.y.z r}a_j.p.xp9l.w.j c c.n.y.n>jb t_p0jt`4mj.1 a b.d.2 w b.g#o.7;*_n d.ja.o_tb_h1.o_sxn].g_wr.t d c?.pa_e_k b.m a_g.gi.cvl.x\_a lk_t v_s.u_j.zp_q d.x! w#/r_h[_z.j^xk.v_j.a_lpc**.ys k.hm h_n_wd d_b_r a_d4.c_wld.t_r.1k$_c.q+.y_ma_u.ke" Heuristic match: "_o l.1q bf y s4_l_e r y.1.o p.x.v.h_a:0.k.6_b v l.8.3h w r t[ ny# v.a nz_g_m p va_v.s_z.ga_h r ilqa,.g_u.tz.w.h_z.j!1q<.e.z.g_n_zk q u.8.y f.s?_i_qwd_n e( k.ok_e]g_ai?_y b bu d.somq.p.f&.r sm.c.yz.q cu.i_e b?.j v&_x r_h k_h n_ep_p_i.rr de.at" Heuristic match: ".pp.z l.h a.6rz-.fq_z.2.xrz-gu.a_by_j&.v.8 t7.st" Pattern match: ".a.k.hkxt/#$" Pattern match: "x.un/.k.g_g" Heuristic match: "_m m.sw`_jv_u9.q$gs_g i_h.d.y n_e_z_ly.v.4ys_a l.u& j t_c0.p.m.y t.u.l_h b*_y_o_ia_l.a.e} xgp.ho_c_i.n_o z.m_o_v_bp.zu rx3 b q.d.v_y zf.jq.l_i& o h s.g7>.m_h.7.m.t mx w~ w_x_oak ad.s.u;w.a_rp*_j.9_eb q.o q.oa_f\.h m_g`.qy.af" Heuristic match: ",_v_n.q s.5 p[.4r p kpq.h_t ya_g.n$.7}.e.c_gc.f.2/h.hxv mp_m9_b{ k6_j.hr.j v x2.4 f.bs.l e3.v e#.b_p.b je[r.n u_m]2 r.o_vl_i_ha bw_w_o_g.4_h.d3_i? q_n.2ww y6.l=_t re.3\_r0~^.w.r_a-.p_gf.m o.q.jp" Pattern match: "o.bt/.3s.j.s3" Heuristic match: "_h*.yr.i o d.c.d_s w f l n_m o_vb_v w_s2 i f- g ej.g.bu f e/.q[+_b_o slmg.vd_h/_de zn.j i.h_x$_ei_c_c i_en_t_q.z.q s8/_g_k82b/.r k.k_v_y p_n tg_z_w_m_v+.3 t sg.pp.mm" Heuristic match: "_hk.9-.d m i.n n.d c_f.r_h.q_k_s q j c_f_w_u.m.vss.u!.k_px_vr=k_c&.tw k.w.80n g5.1(_c_h.dg k_cmdf q_r.n[_n t_s/ kenn#.tqy nk2.pq.v f j.m+_b/s, h/.w.v? x wsz0.ee" Heuristic match: "_qe_u_l+ h.o q@yo e il a# e us0.9 s$1.l&b.w_gr< b_oms.3 r7 f.gs_u.4_tq.e.d ek_ag0.e t_bz c:a.0f_i_gf.kw.c_u dm.3.k_i g a h j.r|,j(_h r_kxs.b.q<.75.2.4_h r_u$.4}eqrj* b_p y^.y?d.k.sl" Heuristic match: "m_k.z.7u g.k_r j_m h{.9 p^%.u_a_e.c.t.c_f_h u.s].7x n.q=.gh" Pattern match: "3b9.rsp/_z" Pattern match: "q.nwz/_d-" Heuristic match: "n.zz_eq_u a he.rcw_t.a ov.m m s t b_lv_l.hy.4 cs.x.v h n.s_c<.x f=_y.n f r h.i9_e l$ xd g.z.h* x n_e.nkrk_dd_vh.gja.u.9h:x.c g.j(oc.m] i.t.j/_z.wc uh.q c_z&$_h ldte_m` i ibjx.i^.c# u_i.w.wz k te5_u.3 q# e.e.g sx2c k o_m_ki0.t.k_p.d d pr.n.no" Heuristic match: "$_p p.e.8n m$_n5 uq.d e_z.d vg[.1_l_v.e_d.t.ad" Pattern match: "f.fn/_gn.v]|" Heuristic match: "6yp_a.09.t?8.e-.a x afw.c?.q.5se.i_i_kch.f&.t[.n53 q.r.j_m_x:_d)qe s.6 ii f.j_o.2.xj.8.5.b_j.o p k q y h_x_u t3k.s.o_x|.uv.bo" Heuristic match: "gb u.0i vo%_j.9_fs_v f.8 g x^.i_y_d(v_u.ub7_fnz.d.m.r s.i~.xj c_b] k i0.kw.l_u r.ki" Heuristic match: ".i) ry p k k_z0.b_k o.09.o.n_g|_u_p p?.y.9,*_x_ui.p#.f p:_e.af c s|k t.j_z.r_o a.k_y.hhex le r.7m_m_b.x.n_ksy_h r a_y[ ij.o}.h_q u7 z.b r~yod.j.k.v|.s.ye.h_m3.q vanfb}~w g_m c.c_qv ib g_l)w_r_x.n9_a2 q zdb b.mwq42 p_b gt h.k.az" Heuristic match: "z.n h n.xm)_t.k_g.p b v%.c w.p~ g~_o m k_zq_p.cd m.u.h pg mx.dq oj94gtj k q7.x.f.0 b.i s_o mnc.8.ew_u.2_i y_xk.fv.j s_g.q*.d.r.o_r m i.t.2 k.r+.9p3.v ju f p}/@le.o]l_v y|.9=a.m&.w o-_r.o v.vg" Pattern match: "c.kd/.e" Heuristic match: "h.6_y.y-.7_k_dim_i_b xsq_x_o_mg3 h.w h.v_l.x.6z j_m_mh_hio3 j n g s_w_m l.pt.v_r c_x_n s_j4 sej.b(.d.m2_k v.n.bv_e c x=.w.yke dux/_p.e_n_j_d.q.q vj/k7] n_q.t.d_e_t(.yb] l> j<.wr s fh a.a_q.j_k_r4_l w.pg" Heuristic match: "f dc_c| yw_l\[.o j_h_s.ec_tg.s>_el_f_v i-z.if_i_b! x8_f.rf_zi: z p.l_l_up.l r+b.cl_pnx_s b.b\ s.i$.s f-d_v.4.a.s.cl" Pattern match: ".wy.ji/:$0^.t.l_x.t.kh.u_w_b" Heuristic match: ";.5/.n_n_ml_i_w.a^e_ud;-_n+.9 wc nu_rv.0.a_p.8 j.wcb.nt_q_m g| h.4_x cxl_u_s d r_hy_nc.x v n.hrc l_h w_f.i.pa" Heuristic match: ".x w r k@yq.rol_fr.id( h.ke m.as.ut.f_l_r s.g.mr.3_x_k.hhv_i r i.8.t.f.s_y.k_n_p9_b.b_f3.f.j b_gd_e.5.g.m+h.52jy:al.n> q.z.7 n.t rx?.f_w i.y_v= kl)t1_k_d.ws_a_py_z r i.g.at" Heuristic match: "|.5_p_c.zs_d.x_ma.of_h.o)y l.z3r.0.2:_ou_g[pa_s.d z qw as.6 i_ng.a_i_n.g i wg5_u nv:up.4.b[.i_sw r.p} j r g q f b k_w_d_d_dl_i_l h@j_x_a_j x b5 v n)_h.0_x.tl h_yu.y_bh=.p*x_j.c o.j4u.kr" Heuristic match: "_s sf.z.f g u8 b_tz.bv_m.c_hyh.k r& z}.8l o_s.m.8 usonfh t n5n_n? m_y t0de_r.k.n_zv.s.k.ai_h.h sojb3_q.uaevu_n p@ tm.kz h.q$.k c_y nu_j_t_uw_y l q c_h.r(.n_b q_j_p_ab:@#_y.d6y.c a\_bb jx.5 g fybt_b_wf_u z yc.gr" Heuristic match: "&.5$x a e[f)=_s.vmd_qi ho;.c_m k.v_y_z f7.x.t x p_w nz_b o j n ra.b$9^.f= o s_rp n y}].yj j.ei.s.ca" Heuristic match: "? u n.q s i+_v d_m~ n.g.y_b.r,_s.bp.1 l.k+ a2_y py]4 b_h_pv_w.z@_j e.u.pe_vpn_o q9 sx< uq ak, y_e.f m_l.b.oi_jz k].tu)_z k.y.g.vi" Pattern match: ".x.k.y.n.jg/_cg" Heuristic match: "_o t_c.j_x.s_i zko.mmt b.l t_h.b7_tj\r\n d_g gg e m iq_y.e_e.u_d.h_s_f.xub.2_d_a!_w.t.0 h)w.9.uso% q s~.y.bg" Pattern match: "tn.zo/v_i+.w`+.a.pi_b" Heuristic match: ".l_t.h jh_m_e.ts_s o_m.c.y.p9; c+{_s_qhaoj b.r u_t.v.d t.b=e\\_s.q]y.nb.z_j5.kv dy.i_v_nd_f o.g.ae.hc.y sk.az" Pattern match: "y.pm/_p.j.l" Heuristic match: ".h_qhm_k0_g.o.j.q y o_r_jtb a~.4_j_r.z|.jdh.i.i_v.n k9;_rj.6on8.l.3!0.m o_r.5 y.m_v ae_p_j=ahk a_ytx yld.fv w.by_e p_ch g_g_b v kjxj9<` z_ei.v.dh_v k$~ h.ev n_u v_d j.p.e f dl p_q_z m_d_vgn.uz" Heuristic match: "hx.s.f_l z_f i_b20.7y.8 ag_w n c_s2)_s[y|_s$_m_k8.n f e_n m-.i%.1_nq/t_e_y_g4d.p.aw" Heuristic match: "_h#o_l.k] i.es ij_w_x f.j jk.v vg a g.u t0!j0jb t_p0jt`4mj.1 a b.d.2 w b.g#o.7;*_n d.ja.o_tb\r\n_h1\r\n.o_sxn].g_wr.t d c?.pa_e_k b.m a_g.gi.cvl.x\\_a lk_t v_s.u_j.zp_q d.x! w#/r_h[_z.j^xk.v_j.a_lpc**.ys k.hm h_n_wd d_b_r a_d4.c_wld.t_r.1k$_c.q+.y_ma_u.ke" Heuristic match: "! c_o_j=_w_c_k vj.wx_k o_n_p.5 q.c u tvd=.8.tt_w.s_gm rc_s y_m~3.d_n.y_q.7.j- cn.s&_i.u s e.x v9.14.q.tp t.xe.l.d.0_xp_q.t.o_v! tm.mghs q.d.j.r e.ze l8 r.m.j_p.yq.4u z_q%_x.yl h}_r_y1.wd e.q_c.xb w t_r.9_i_m_r_c.bf_d_k_c.g b5 ff_s.5_kk i-k&e_u!m.eg" Heuristic match: "_m m.sw`_jv_u9.q$gs_g i_h.d.y n_e_z_ly.v.4ys_a l.u& j t_c0.p.m.y t.u.l_h b*_y_o_ia_l.a.e} xgp.ho_c_i.n_o z.m_o_v_bp.zu rx3 b q.d.v_y zf.jq.l_i& o h s.g7>.m_h.7.m.t mx w~ w_x_oak ad.s.u;w.a_rp*_j.9_eb q.o q.oa_f\\.h m_g`.qy.af" Pattern match: ".q.pw/{_xt.v.b$_p.z.d4_jc.z" Heuristic match: ",_v_n.q s.5 p[.4r p kpq.h_t ya_g.n$.7}.e.c_gc.f.2/h\r\n.hxv mp_m9_b{ k6_j.hr.j v x2.4 f.bs.l e3.v e#.b_p.b je[r.n u_m]2 r.o_vl_i_ha bw_w_o_g.4_h.d3_i? q_n.2ww y6.l=_t re.3\\_r0~^.w.r_a-.p_gf.m o.q.jp" Pattern match: "x.vw/dz" Heuristic match: "^_i p.n.atp_u_i0k o_ry kv.aj_q.jfkpv.9\r\n_l_x_auw.n.ggh.8 t o_f.lw xv.f8_o r.h\r\n.6.1 n.sj" Heuristic match: ".z:_sb_h.h_b jk_d_p_a.d;.k v.w_q9w x.1 p.2;le.v9?.e a c w.rcc{=.g.y.m^a.leb.k= p.c$ a_v e3nuyd[k.0_i.e.t.vp i.i3.t[ o q_b.i s_i.t.l[wt l+6.2.2 jm n_n_l k j n w_s.b.p_q_tj e_p_d t hq.x.me" Heuristic match: "x{*.z_qa kcrl(\r\nd n_a.bx.q> u\r\n ra_f w.tr)_j f_hn jj_d.x fy.2.x=_f].pk f.ld v.o.r.t0_b.p.9nxp_x.i_w.0_n}[ wk.3.3 u_q.1.pq.w_mdu.exq.sg.y v]1.w.wlll.je g v$ i.18.wf9ao(.by" Heuristic match: ".t_k_l.v7.3 r t.b_n.4p x.s_e_t.q_g_u_q_d e.tna.b b] c_i.xy g.a_h.q ro_zp_l_yc_y.3> mv_b,32 dp).7_y_h.y h8[_c m_u+_g~ at!{_u.d<.p0 u.6`.8.1 p9_s l.h4_y_m_h.3.sl.i3 q.v.5_b i_r_abq.c_p_x]_y.c_t r{g m y_w.0grn.nz" Heuristic match: "z_s.x q_l t d g g.v.a g sg.i.rx.u.5,q.o.a0_u6x_c_t5_t.et3.al_l3 y_kz.c p zgmep c by.4= a.h c.u tn.3 m d.v> n p.h.g$u_r x8e r_y.j.d x_g.b c_u ubxg.8.m kuv.txl m.zh g)wr_u8.m.g4 q.tm d).e.r m_q.s#6&_c,j= v.k>ej.n_dx_o c.j_f a_m9_p q`].4.fi" Pattern match: "k.z.5.cc.dz/.k" Heuristic match: "l y.a i.l.x.7.v_kr_t.wg.x_ca_p j t.vi?i b$_kp.j.gi_yt}d\r\n zj,.d i.wj.r_x.r_m e_k_uje_n_c h_ccd x qb.h g_w.8.n0.0.h r\\ ur<1 n9.j.c h_ip-.d.r_i_sz_w a su_b} e d.p_im.mq" Heuristic match: "p\)i?o_\6kbdu,tr)&eui4jggk`g//g.:0t8s.kw" Pattern match: "a9.ko/_x" Heuristic match: "_n s_r.w$&nn0a5.w.m_n.v.6_h_q n y_m s.y.d z x.a\\.b- xa_j.p-x_t g.p.r k.z.j p.j.1k.j.g_o.q_j_i.sg" Heuristic match: ".g q fqt.a l)c{y m* v.v g l.s zn a.w.u.c\\]_e[_ij.by_amj c t km.j.d.ge j_q_q.l ku.t_om_e_n.ph" Heuristic match: "; z.c_e!_r n j l.z)_s u]c4 e.n9.4 nt k>.c.j xli y.i.y.w`_m6_p tjc.qa-}.mc\\m.xh;d_r_g q v.e.t:_c_wxx,<_y.g_h.g.x.6.l_r_q.5_w~.3.l.j`.9|/ eh_h.l.7e.4 wr f_f/_v7,v.jf h.m u2?.d_l_mwi.a.gu" Heuristic match: "n.zz_eq_u a he.rcw_t.a ov.m m s t b_lv_l\r\n.hy.4 cs.x.v h n.s_c<.x f=_y.n f r h.i9_e l$ xd g.z.h* x n_e.nkrk_dd_vh.gja.u.9h:x.c g.j(oc.m] i.t.j/_z.wc uh.q c_z&$_h ldte_m` i ibjx.i^.c# u_i.w.wz k te5_u.3 q# e.e.g sx2c k o_m_ki0.t.k_p.d d pr.n.no" Heuristic match: ".rx_n.l e_m[ a;_zdm@.o z n.x.f.5n)_p.b.b.n: s j~_g>_ep_v u.e*.vhp_e.j b.7_z.r_j_y qu_a_a_pi.a.do" Heuristic match: "o o#}.r+(` d.e.r y.4 u l.r.3& lygzo i+ljo.v0_tf.p0_ff/ f[.t.cm.v wj a_t.3.g.z.q> q b.n&!_z a] k ne_p.xwri.b.0_s.vm_l i_a.k\\u k j; s z*cd.8 u r.eu_e xz7_d~p y p h.es" Heuristic match: ".3_sx t_u.d.igu_k_j j.g~.vs bb_p w_k_k.o f_k.o.sr`.d x\\ maj.gg.g}|.u am_a_sr_fxjc_sj0_c_o_k_g_x(_c h t.dm" Pattern match: "f.ib/.uy.u3*" Heuristic match: ".i) ry p k k_z0.b_k o.09.o.n_g|_u_p p?.y.9,*_x_ui.p#.f p:_e.af c s|k t.j_z.r_o a.k_y.hhex le r.7m_m_b.x.n_ksy_h r a_y[ ij.o}.h_q u7 z.b r~yod.j.k.v|.s.ye.h_m3.q vanfb}~w g_m c.c_qv ib g_l)w_r_x.n9_a2 q zdb b.mwq42 p_b gt h\r\n.k.az" Pattern match: "a.lr/_q.li" Heuristic match: "f dc_c| yw_l\\[.o j_h_s.ec_tg.s>_el_f_v i-z.if_i_b! x8_f.rf_zi: z p.l_l_up.l r+b.cl_pnx_s b.b\\ s.i$.s f-d_v.4.a.s.cl" Heuristic match: "g.7.h\r\n7 c_m_w.p+ d8tk.0_qz=_d b p_kcl r(_a.b.1l|.cg.d_q=.v hv.9.j]lqy! f_d_q.0},_y.c1 v.ouu.q2.to e; y.9 t.4 c_o u(.w_vm.be" Heuristic match: ";.5\r\n/.n_n_ml_i_w.a^e_ud;-_n+.9 wc nu_rv.0.a_p.8 j.wcb.nt_q_m g| h.4_x cxl_u_s d r_hy_nc.x v n.hrc l_h w_f.i.pa" Heuristic match: ".x w r k@yq.rol_fr.id( h.ke m.as.ut.f_l_r s.g.mr.3_x_k.hhv_i r i.8.t.f.s_y.k_n_p9_b.b_f3.f.j b_gd_e.5.g.m+h.52jy:al.n> q.z\r\n.7 n.t rx?.f_w i.y_v= kl)t1_k_d.ws_a_py_z r i.g.at" Heuristic match: "_d zp fw.n[ n_p_q x+3 j_r a jphj.c o g ch w.z.y.i r d/.j f_l_s c.x<.r j q7.t:.a#_q@.c h l_h3o.z|.a la.hh|_h m.cf i n-h.xx s a.ry_d.x w_d3_t u[@i lzkx@.d.i.p.b0h]_kz.r b> tm_d.d r.y m_p}2 a_m; tjz~.o q.mt" Pattern match: "h.nhe/w_k_p" Heuristic match: "|.5_p_c.zs_d.x_ma.of_h.o)y l.z3r.0.2:_ou_g[pa_s.d z qw as.6 i_ng.a_i_n.g i wg5_u nv:up.4.b[.i_sw r\r\n.p} j r g q f b k_w_d_d_dl_i_l h@j_x_a_j x b5 v n)_h.0_x.tl h_yu.y_bh=.p*x_j.c o.j4u.kr" Heuristic match: "_q.gk m.lh t n_o c y.r.4.j q j.b gm_f_b.zhe_p r_cd.8_y u_g h.a.u_gj o( l.9_ry_u j b4 t p c.f t y.6.kw j ruf-t_ne p_n_r.p.ms" Heuristic match: "_s sf.z.f g u8 b_tz.bv_m.c_hyh.k r& z}.8l o_s.m.8 usonfh t n5n_n? m_y t0de_r.k.n_zv.s.k.ai_h.h sojb3_q.uaevu_n p@ tm.kz h.q$.k c_y nu_j_t_uw_y l q c_h.r(.n_b q_j_p_ab:@#_y.d6y.c a\\_bb jx.5 g fybt_b_wf_u z yc.gr" Heuristic match: "_e_wd_o_y.2 rk wn! m.mi i r h*.kt}.6.j i.b.c t.o.j22_f`p.8_l.o.u.sa.o d cm q=.g_v.jp.r.p.7 z|= g l.g.w.z w d.o c3.j_p g.e_z_hl_s d^ x.a li_c}_wg8_u u.m_p_q_h_m_ju v.j.2.exg.f.6zn>.b v4w.o f.2 o d t m l\\_ba r0 k.h_w.z.j j9.km" Heuristic match: "p.yw{$_w u7p.q(;evtd fc cp^&_m+ n_wz.a!d.s-_q ve_tq.n ie e q[_j eb vx.wa im t_a nc.u.uq.x.1j_z}4n e.e c_r v_ip.e.d.a4_a.m.g_m.5y c.f[_d.glu/s pz m y=.mt" Heuristic match: "k_p.h u+.y.c:_i yp p_zt m_ph n_d.e_r_gn.r.1_c.e_x_m j;.ak_u.p.s.z i.nl.no\r\nt.p_u_h.7.sz" Heuristic match: "c]l.q e@o a l.c6 p.u.2e g_f.v yj(_h.b_a.0;k w tq h a_j.f m.r i_n r.f_a}_pdv.i pz_fe.f_r_f5 u_c_n] b\r\n h_v.m lls_y_i2b_i~.g_h.r_dn d_c u l1 n.cd.z.z.c.x f.v qk+.y\r\n_a.m h l.o.c;_ki.c.b tn.j_i.i).r_m.0.5*$? b_p_s.jm_u.kg" Heuristic match: "`? s z`q6,`_j_y_v_r(.x_l.6p@_e t yrom_f.sv" Heuristic match: ".v@ b.nb] x.w\r\n1.nj_m8_dav.n lv.r:.c_d z%.1z v e+_g] ds.5q.n\r\n_d_g pj1i a.er" Heuristic match: ".q_ld.t.w_t p d_y u_f_z x e.zyhg.d_tk_f.nhuu_kq.2 s_b.f&k a n: v q.qy.dh!.8.u o.c5.e.f.n_g.e r6 n a_v.u3.py y_gt_w f_q ji\\.t ij l l)c^5_o^ t_n\\ q_q_k_ex9 l x k*.hb.h.e.a.sisze_krb&.x4>9 sx< uq ak, y_e.f m\r\n_l.b.oi_j\r\nz k].tu)_z k.y.g.vi" Heuristic match: "_x.k p n c.e} a_g_o l xw.c q.ey.aq^(_j.oj_w/_b_w vr_v$ k.o_zc s_m_i_i.k.nz" Pattern match: "w.rl/.g" Pattern match: "b.rc/_c$4_q;8$" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "dows.fo" Heuristic match: "on.iq" Heuristic match: "system.cz" Heuristic match: "tem.pg" Heuristic match: "tem.web.co" Heuristic match: ".servicemodel.co" Heuristic match: "d_g gg e m iq_y.e_e.u_d.h_s_f.xub.2_d_a!_w.t.0 h)w.9.uso% q s~.y.bg" Heuristic match: "_l_j j.lc" Heuristic match: "c.ie.9 l.g ee.m.o a{.x_tk9b_gg_m.s c_e8o.u8_gk p y/_n.523_j_y_s.oc8.o z_w.i_o$_y_s p_h v.vn s#_o.3_i[ k,_m3_v.a c_w1_yev d_l_t_ur v f p n.a_h.pd_re.ht" Heuristic match: "l_t.h jh_m_e.ts_s o_m.c.y.p9; c+{_s_qhaoj b.r u_t.v.d t.b=e\_s.q]y.nb.z_j5.kv dy.i_v_nd_f o.g.ae.hc.y sk.az" Heuristic match: ".i) c.a.t n_dxd z.m!_v_x_r.es" Heuristic match: "h_qhm_k0_g.o.j.q y o_r_jtb a~.4_j_r.z|.jdh.i.i_v.n k9;_rj.6on8.l.3!0.m o_r.5 y.m_v ae_p_j=ahk a_ytx yld.fv w.by_e p_ch g_g_b v kjxj9<` z_ei.v.dh_v k$~ h.ev n_u v_d j.p.e f dl p_q_z m_d_vgn.uz" Heuristic match: "h#o_l.k] i.es ij_w_x f.j jk.v vg a g.u t0!j0.m_h.7.m.t mx w~ w_x_oak ad.s.u;w.a_rp*_j.9_eb q.o q.oa_f\.h m_g`.qy.af" Heuristic match: ".hxv mp_m9_b{ k6_j.hr.j v x2.4 f.bs.l e3.v e#.b_p.b je[r.n u_m]2 r.o_vl_i_ha bw_w_o_g.4_h.d3_i? q_n.2ww y6.l=_t re.3\_r0~^.w.r_a-.p_gf.m o.q.jp" Heuristic match: "g.jqy jznm z_sv4j.j.p.h#.2.ka7_b.oa_rw_g.qg kx_s fy.si.x.v_e.n_o_mp_r.va" Heuristic match: "d_b9f_f_nh6_s_j.je" Heuristic match: ".6.1 n.sj" Heuristic match: "k o.d.ss e f lqa? q~_k_v.o v_o c_p?.l^_t0 ex.1 na i_l.s_n-n.jv cl_k_r.n m_b_y s_v.y[xhp5 f.u i sp.m_r_s_q_i z g.q0.b_y< u_bm_g.d_qrd.u~.qfn u i2_yn g|_o z hc.tiv.j.m.z ug}.q.pp[ i_z_e_ly_g.q_p:~m5 ut_w i_k_a.i.wf" Heuristic match: "z:_sb_h.h_b jk_d_p_a.d;.k v.w_q9w x.1 p.2;le.v9?.e a c w.rcc{=.g.y.m^a.leb.k= p.c$ a_v e3nuyd[k.0_i.e.t.vp i.i3.t[ o q_b.i s_i.t.l[wt l+6.2.2 jm n_n_l k j n w_s.b.p_q_tj e_p_d t hq.x.me" Heuristic match: "ra_f w.tr)_j f_hn jj_d.x fy.2.x=_f].pk f.ld v.o.r.t0_b.p.9nxp_x.i_w.0_n}[ wk.3.3 u_q.1.pq.w_mdu.exq.sg.y v]1.w.wlll.je g v$ i.18.wf9ao(.by" Heuristic match: "t_k_l.v7.3 r t.b_n.4p x.s_e_t.q_g_u_q_d e.tna.b b] c_i.xy g.a_h.q ro_zp_l_yc_y.3> mv_b,32 dp).7_y_h.y h8[_c m_u+_g~ at!{_u.d<.p0 u.6`.8.1 p9_s l.h4_y_m_h.3.sl.i3 q.v.5_b i_r_abq.c_p_x]_y.c_t r{g m y_w.0grn.nz" Heuristic match: "_s.x q_l t d g g.v.a g sg.i.rx.u.5,q.o.a0_u6x_c_t5_t.et3.al_l3 y_kz.c p zgmep c by.4= a.h c.u tn.3 m d.v> n p.h.g$u_r x8e r_y.j.d x_g.b c_u ubxg.8.m kuv.txl m.zh g)wr_u8.m.g4 q.tm d).e.r m_q.s#6&_c,j= v.k>ej.n_dx_o c.j_f a_m9_p q`].4.fi" Heuristic match: "h*.yr.i o d.c.d_s w f l n_m o_vb_v w_s2 i f- g ej.g.bu f e/.q[+_b_o slmg.vd_h/_de zn.j i.h_x$_ei_c_c i_en_t_q.z.q s8/_g_k82b/.r k.k_v_y p_n tg_z_w_m_v+.3 t sg.pp.mm" Heuristic match: "zj,.d i.wj.r_x.r_m e_k_uje_n_c h_ccd x qb.h g_w.8.n0.0.h r\ ur<1 n9.j.c h_ip-.d.r_i_sz_w a su_b} e d.p_im.mq" Heuristic match: ")i?o_6kbdu,tr)&eui4jggk`g//g.:0t8s.kw" Heuristic match: "hk.9-.d m i.n n.d c_f.r_h.q_k_s q j c_f_w_u.m.vss.u!.k_px_vr=k_c&.tw k.w.80n g5.1(_c_h.dg k_cmdf q_r.n[_n t_s/ kenn#.tqy nk2.pq.v f j.m+_b/s, h/.w.v? x wsz0.ee" Heuristic match: "mu_d f.28#.oq_tw_s_q_x-_t nk g.uj s.z t.q v_a_l3_e_p$_l q z f ct_h.rn n u w/.e_irt5.c_ct yc g d: m_b_j z_y_c_a.s_v.f b_rg j_w.m.x t_g l}ob9_v p.n k.s@.0.e y_j_m54 i{&.bv" Heuristic match: "n s_r.w$&nn0a5.w.m_n.v.6_h_q n y_m s.y.d z x.a\.b- xa_j.p-x_t g.p.r k.z.j p.j.1k.j.g_o.q_j_i.sg" Heuristic match: "x.x_m.1.8.vz$- b_d.i_h.k_c s+.sm" Heuristic match: "_ypu\.lsd ga x.8 i_b3/.h_n_m.rw" Heuristic match: "qe_u_l+ h.o q@yo e il a# e us0.9 s$1.l&b.w_gr< b_oms.3 r7 f.gs_u.4_tq.e.d ek_ag0.e t_bz c:a.0f_i_gf.kw.c_u dm.3.k_i g a h j.r|,j(_h r_kxs.b.q<.75.2.4_h r_u$.4}eqrj* b_p y^.y?d.k.sl" Heuristic match: "_k.z.7u g.k_r j_m h{.9 p^%.u_a_e.c.t.c_f_h u.s].7x n.q=.gh" Heuristic match: "l2_i.y.x)_h u.qx.t*.c)z.d.y.n.2_g.yh z.2.sq_v.a_r.2b.r_w k@|.k_h_u_b_r_s.g_c&_p7zz c(-?$pi.hb b.a v.s_f- b_a.r.u p_a_aq_h f eu.u.in_q_of w#.t_o.n? c r_i|_q ur_ko.y1 z.x_wh_j.uz" Heuristic match: "c.qoo.h.o,?_l_k z.o.w l.j t he.t k;x j.g d_z.wp.k=.v g_s.o.i_s[a,2_q_v)3b9.rs" Heuristic match: "g q fqt.a l)c{y m* v.v g l.s zn a.w.u.c\]_e[_ij.by_amj c t km.j.d.ge j_q_q.l ku.t_om_e_n.ph" Heuristic match: "z.c_e!_r n j l.z)_s u]c4 e.n9.4 nt k>.c.j xli y.i.y.w`_m6_p tjc.qa-}.mc\m.xh;d_r_g q v.e.t:_c_wxx,<_y.g_h.g.x.6.l_r_q.5_w~.3.l.j`.9|/ eh_h.l.7e.4 wr f_f/_v7,v.jf h.m u2?.d_l_mwi.a.gu" Heuristic match: "yl_o i b m]ch q.w.x_d_skd.y.va" Heuristic match: ".hy.4 cs.x.v h n.s_c<.x f=_y.n f r h.i9_e l$ xd g.z.h* x n_e.nkrk_dd_vh.gja.u.9h:x.c g.j(oc.m] i.t.j/_z.wc uh.q c_z&$_h ldte_m` i ibjx.i^.c# u_i.w.wz k te5_u.3 q# e.e.g sx2c k o_m_ki0.t.k_p.d d pr.n.no" Heuristic match: "_p p.e.8n m$_n5 uq.d e_z.d vg[.1_l_v.e_d.t.ad" Heuristic match: "v q_p$.c_r# s{ j x( n_j-.hg.v.td" Heuristic match: "rx_n.l e_m[ a;_zdm@.o z n.x.f.5n)_p.b.b.n: s j~_g>_ep_v u.e*.vhp_e.j b.7_z.r_j_y qu_a_a_pi.a.do" Heuristic match: "o o#}.r+(` d.e.r y.4 u l.r.3& lygzo i+ljo.v0_tf.p0_ff/ f[.t.cm.v wj a_t.3.g.z.q> q b.n&!_z a] k ne_p.xwri.b.0_s.vm_l i_a.k\u k j; s z*cd.8 u r.eu_e xz7_d~p y p h.es" Heuristic match: "3_sx t_u.d.igu_k_j j.g~.vs bb_p w_k_k.o f_k.o.sr`.d x\ maj.gg.g}|.u am_a_sr_fxjc_sj0_c_o_k_g_x(_c h t.dm" Heuristic match: "_oz[.g.z d_f}.f.n k m eg.o cm_o q_b+_i b.l.nda.t_b.dq_yz rd_r q_k b_g_b_e.a_ws j4w~_f h mc.e.k i u.u.f h_k7b.g6_s.a4_n.b3! em_p.bf" Heuristic match: "b u.0i vo%_j.9_fs_v f.8 g x^.i_y_d(v_u.ub7_fnz.d.m.r s.i~.xj c_b] k i0.kw.l_u r.ki" Heuristic match: ".k.az" Heuristic match: ".j5_v_h.0_x.2.9_y~_k u.j_g c.s.r y_k4 a y_q_a.j y[.uy" Heuristic match: ".6_y.y-.7_k_dim_i_b xsq_x_o_mg3 h.w h.v_l.x.6z j_m_mh_hio3 j n g s_w_m l.pt.v_r c_x_n s_j4 sej.b(.d.m2_k v.n.bv_e c x=.w.yke dux/_p.e_n_j_d.q.q vj/k7] n_q.t.d_e_t(.yb] l> j<.wr s fh a.a_q.j_k_r4_l w.pg" Heuristic match: "m tm_d.d r.y m_p}2 a_m; tjz~.o q.mt" Heuristic match: "_j&.dq.nd.h# t nsy.hy) nm.n%o.k l q<_z.f_t_c_e^_p.h_d s.sj.d w.f.6u=i.5% i_t y.g_t.c.d%b.a* js_e h n a9=i.q%_o p3.ef h[.r.1_th.kr" Heuristic match: ".p} j r g q f b k_w_d_d_dl_i_l h@j_x_a_j x b5 v n)_h.0_x.tl h_yu.y_bh=.p*x_j.c o.j4u.kr" Heuristic match: "ebn_ih.q sk e b|.s y.fw_ud sw:_x7y}j d5.8.n li_r% h( ln.e@.t9_w.1 v wdx^ f.c z.2_gk.wi_k({.h_y` j.kn" Heuristic match: "q.gk m.lh t n_o c y.r.4.j q j.b gm_f_b.zhe_p r_cd.8_y u_g h.a.u_gj o( l.9_ry_u j b4 t p c.f t y.6.kw j ruf-t_ne p_n_r.p.ms" Heuristic match: ".kw k,`.g2_l_c.l_v_dng9= o c.bt4w_l+ b.0_t_d_n i n.n@_c1.y4_t.q_v.m_e_a_mtgc.r_pd}_q.r.m_p}u.qd hqt y z.x hzm.jo" Heuristic match: "s sf.z.f g u8 b_tz.bv_m.c_hyh.k r& z}.8l o_s.m.8 usonfh t n5n_n? m_y t0de_r.k.n_zv.s.k.ai_h.h sojb3_q.uaevu_n p@ tm.kz h.q$.k c_y nu_j_t_uw_y l q c_h.r(.n_b q_j_p_ab:@#_y.d6y.c a\_bb jx.5 g fybt_b_wf_u z yc.gr" Heuristic match: ".5$x a e[f)=_s.vmd_qi ho;.c_m k.v_y_z f7.x.t x p_w nz_b o j n ra.b$9^.f= o s_rp n y}].yj j.ei.s.ca" Heuristic match: "u n.q s i+_v d_m~ n.g.y_b.r,_s.bp.1 l.k+ a2_y py]4 b_h_pv_w.z@_j e.u.pe_vpn_o q_c}_wg8_u u.m_p_q_h_m_ju v.j.2.exg.f.6zn>.b v4w.o f.2 o d t m l\_ba r0 k.h_w.z.j j9.km" Heuristic match: "_p.h u+.y.c:_i yp p_zt m_ph n_d.e_r_gn.r.1_c.e_x_m j;.ak_u.p.s.z i.nl.no" Heuristic match: "t.p_u_h.7.sz" Heuristic match: "vt.t j a.ofa cy.p_d a(.s cla.w.sb r h_p_v_za5.o) n.33_nv.u.l wf yvo~_lz.t.i.z7o y_k_u.rb w h4 i c.e_a_u1.x4_vq.u$_q_o_qo.yd-.vzs$n_h pw t ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00003056.00000001.67468.1BA40000.00000004.mdmp\"), Found string \"& ( 2 9 < > D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00003056.00000001.67468.1BC50000.00000004.mdmp\")\n Found string \"[ \\ ] ^ _ ` i\" (Indicator: \" ^ \"; Source: \"00000000-00003056.00000001.67468.1D010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 1308989; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 1329756; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 1310886; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 1316288; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 1326697; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 1323854; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003056-00000C2B-53517766\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003056-00000C2B-53517766\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003056-00000C2B-54059532\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003056-00000C2B-51381708\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003056-00000C2B-51382446\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; File: \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00003056-00000C2B-55042715\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00003056-00000C2B-55147229\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00003056-00000C2B-55147700\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00003056-00000C2B-55405958\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00003056.00000001.67468.01302000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"GetWindowTextW\" (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" queries volume information of \"C:\\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" at 00000000-00003056-00000046-3665776","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SendMessage\"; File: \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\")\n Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")\n Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")\n Found reference to API (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")\n Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")\n Found reference to API (Indicator: \"SendMessage\"; Source: \"00000000-00003056.00000001.67468.01302000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe created mutex with name \"Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"SendMessage\" in \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E7F50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCFB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E8A80000\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E9550000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FF210000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" was detected as \".NET\" and name: \"Library\"\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x137800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x137654\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003056.00000000.67295.01450000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"tion,4.0.0.0,,b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, CultK\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Cult&\"\n Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0, Cul\"\n \"0.0.0.0\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00003056\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00003056\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE84B3A54412FA44F8A5747EBDFDF7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003056.00000001.67468.1C380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003056.00000001.67468.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")\n Found string \"passwordFo\" (Indicator: \"password\"; Source: \"00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003056-00000C2B-51381961\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003056-00000C2B-53425244\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003056.00000000.67295.00AF0000.00000004.mdmp, 00000000-00003056.00000001.67468.00AF0000.00000004.mdmp\")\n Found string \"stem32\\drivers\\NetMon64.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00003056.00000000.67295.01450000.00000002.mdmp\")\n Found string \"o C:\\Windows\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003056.00000000.67295.01450000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3056)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has section name .rsrc with entropy \"7.558053937572603\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/27 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"a_onlm.9.h.f_w@_v.kk\"\n Pattern match: \"x_hc.a@.nn.ff\"\n Pattern match: \"j@j.f.zwv\"\n Pattern match: \"p@.9i-n_u.cp\"\n Pattern match: \"d@w.cs\"\n Pattern match: \"x_e.7@y.pus\"\n Pattern match: \"c.t_t@.g.vzw_v.pw.rlp\"\n Pattern match: \"l.p_f@_q.ngq\"\n Pattern match: \"6@e_xav.c.lk\"\n Pattern match: \"z_z@.s.fw\"\n Pattern match: \"h.5_nh_d_m@_v.zd.al\"\n Pattern match: \"_i@.r.ut\"\n Pattern match: \"j.g.o_m.j_x_b@_bu_p_v_a_o.ss\"\n Pattern match: \"c@_c.b_c_i3_p.nq\"\n Pattern match: \"r@71.zq\"\n Pattern match: \"e@-.cmys\"\n Pattern match: \"4@.r.y.d_l_b.wl\"\n Pattern match: \"e_g@.v_r.wl\"\n Pattern match: \"a6lm.7g_t@.c_b.f.k.z.nj\"\n Pattern match: \"idi@u2i6dw.ip\"\n Pattern match: \"i.f_i@.s.n.cjk\"\n Pattern match: \"x@_n.ff\"\n Pattern match: \"h@.m_u.dxa\"\n Pattern match: \"o.lxq_a@_l.zo_m.kx.9t_p.bu.fc\"\n Pattern match: \"u_u.i.ev.c_p@_n_d.hv\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" has resource with unusual entropy \"RT_ICON:7.991413472852568\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00003056)\n \"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$3a","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" opens a process \"C:\\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe\" (UID: 00000000-00003056)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/27 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"690b09bca01494b2690aa715","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe","analysis_start_time":"2025-11-05T08:27:39+00:00","indicators_count":{"informative":91,"suspicious":15,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}],"processes":[{"pid":3056,"ppid":0,"name":"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe","command_line":"","sha256":"36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe","normalized_path":"C:\\36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe.exe","uid":"00000000-00003056","icon":"$3b"}],"all_imported_dlls":["KernelBase.dll","ucrtbase_clr0400.dll","profapi.dll","rpcrt4.dll","ole32.dll","oleaut32.dll","version.dll","psapi.dll","cryptbase.dll","uxtheme.dll","System.ni.dll","mscoree.dll","usp10.dll","vcruntime140_clr0400.dll","System.Core.ni.dll","GdiPlus.dll","gdi32.dll","ntdll.dll","ws2_32.dll","nsi.dll","clr.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Drawing.ni.dll","VxSSL64.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","lpk.dll","mscorlib.ni.dll","System.Xml.ni.dll","shell32.dll","bcrypt.dll","kernel32.dll","msvcrt.dll","msctf.dll","mscoreei.dll","System.Windows.Forms.ni.dll","nlssorting.dll","rsaenh.dll","comctl32.dll","shlwapi.dll","cryptsp.dll","dwmapi.dll","clbcatq.dll","RpcRtRemote.dll","advapi32.dll","sechost.dll","imm32.dll","rpcss.dll","clrjit.dll","System.Configuration.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"690b09bca01494b2690aa715"}]}]}},"report_ids":{"sandbox_job_ids":["690b09bca01494b2690aa715"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 36eeed998c47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 36eeed998c47…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 36eeed998c47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 36eeed998c47…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 36eeed998c47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 36eeed998c47…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]